/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

1 vote124 views1 answer
Force to kill any process port ubuntu
Shell/Bash
0 vote123 views1 answer
Cognito terraform module
Shell/Bash
0 vote129 views1 answer
Nuxt .env file not load
Shell/Bash
0 vote185 views1 answer
Start of .sh file
Shell/Bash
0 vote132 views1 answer
Install jupyter homebrew
Shell/Bash
1 vote134 views2 answers
Iptable show all rules
Shell/Bash
18 votes130 views3 answers
Sudo: add-apt-repository: command not foun
Shell/Bash
0 vote129 views1 answer
Clear arp table ubuntu]
Shell/Bash
0 vote212 views1 answer
Get docker image from docker hub
Shell/Bash
37 votes138 views6 answers
Git discard unstaged files
Shell/Bash